Wazuh CVE-2026-61783

Exploitation requires an authenticated low-privilege user (PR:L confirmed by CVSS vector) in Wazuh 4.14.0-4.14.6 whose RBAC role or policy includes at least one explicit DENY effect on the manager:update_config or cluster:update_config action. This is a non-default, administrator-applied configuration; the flaw is not triggered for accounts whose roles have no rule at all for these actions (those accounts retain masking). The attacker must also be able to reach the Wazuh manager REST API over the network (AV:N) and must know to append raw=true to the configuration endpoint request. Unauthenticated exploitation is not possible. Exploitation is further limited to the specific Wazuh version range 4.14.0-4.14.6; accounts with only allow rules or no rule for update-config are not affected.

The CVSS 4.0 score of 7.0 with VC:H and SC:H accurately reflects meaningful risk: the cluster.key governs Wazuh cluster membership and encrypted inter-node communication, so its disclosure could allow an attacker to impersonate a cluster node or decrypt cluster traffic, extending impact beyond the single compromised account (SC:H). The AT:P component correctly signals that exploitation requires a specific RBAC configuration - only accounts with an explicit deny on update-config actions are affected - which narrows the at-risk population. Critically, this condition is most likely to be met in security-conscious deployments that have actively hardened their RBAC policies, creating an ironic exposure: tighter hardening paradoxically enables the flaw. No KEV listing and no public POC exist, keeping real-world exploitation risk moderate. EPSS score was not provided in the input data, so quantified exploitation probability cannot be stated. This should be treated as a high-priority patch for any Wazuh 4.14.x deployment using explicit RBAC deny policies, and a medium-priority patch for deployments without such policies.

An attacker with a low-privilege Wazuh account - one whose assigned role was hardened with an explicit deny on manager:update_config - sends a single authenticated HTTP GET request to the Wazuh manager configuration API appending ?raw=true. The broken masking gate, misidentifying the deny entry as update permission, returns the full ossec.conf XML in cleartext including the cluster.key value. The attacker then uses the extracted key to register a rogue node into the Wazuh cluster or to decrypt inter-node encrypted communication.